Star City Security Consulting - SC2

PolicyPress is live on the GitHub Marketplace

Ben Craton, CISSP PMP — Sat, 01 Aug 2026 00:00:00 +0000

PolicyPress, our compliance policy toolchain, is now available on the GitHub Marketplace</a>. Write your security policies in Markdown, keep them in your own Git repository, and a single GitHub Action publishes a branded policy site and versioned, audit-ready PDFs on every push.</p>

PolicyPress - Compliance Policies from Markdown

Ben Craton, CISSP PMP — Fri, 31 Jul 2026 00:00:00 +0000

PolicyPress</h2>
Policies in Git. Audit-ready PDFs on every push.</strong></p>
View on GitHub →</a> · Live demo →</a> · On the GitHub Marketplace →</a></p>

Why we built it</h3>
Most small and mid-sized organizations keep their security policies in a Word document someone emailed around - nobody knows which version is current, who approved it, or when it was last reviewed. The usual fixes overshoot: GRC suites are priced and designed for enterprises, and wikis like Notion or SharePoint can’t produce the versioned, signed-off PDF trail an auditor or customer actually asks for.</p>
PolicyPress is the proportionate answer. Your policies live as Markdown files in your own Git repository, and a single GitHub Action turns them into a branded policy site and audit-ready PDFs on every push. PolicyPress is the theme and toolchain, not the content - your policies never leave your infrastructure.</p>
If you are comfortable enough with GitHub to click a button and edit a text file, you can have a professional policy library in an afternoon. You do not need to know anything about web development, LaTeX, or compliance frameworks.</p>

What it does</h3>

A policy website your employees can bookmark</strong> - branded with your logo and colors, searchable, with a data-driven dashboard homepage showing policy count, review status, and framework coverage</li>
A versioned PDF for every policy</strong> - named by title and version, generated from the same Markdown source as the site</li>
Full revision history</strong> - who approved what, and when, rendered into both the site and the PDFs</li>
Draft watermarks and redaction</strong> - policies under review get a DRAFT watermark; internal notes marked with redaction tags are stripped from published PDFs</li>
Compliance mapping</strong> - tag policies with Secure Controls Framework and SOC 2 (TSC 2017) control IDs and get coverage reports as versioned PDFs</li>
Accessible PDFs, opt-in</strong> - tagged PDF/UA-1 output validated by veraPDF in CI, and a site that passes automated WCAG 2.1 AA checks in light and dark mode</li>
Audit bundle, opt-in</strong> - a machine-readable manifest with SHA-256 hashes of every PDF and its Markdown source, plus revision and coverage data</li>
Private by default</strong> - the starter ships with search-engine indexing off and includes a turnkey SSO deployment configuration</li> </ul>

How it works</h3>

Your policies live in a Git repository as Markdown files with a small front-matter block (owner, review date, revision history, control tags)</li>
On every push, the `sc2in/policypress</code> GitHub Action builds the policy site and generates the PDFs</li>`
`The site deploys to GitHub Pages; PDFs are published alongside it for download</li> </ol> The workflow step is three lines plus options:</p>`- uses: sc2in/policypress@v1 with: config_path: config.toml # path to your config.toml draft_mode: false # true → DRAFT watermark on all PDFs redact_mode: true # true → strip redacted blocks from PDFs </code></pre> The Action runs on Linux and macOS runners (ubuntu-latest</code> recommended). You can author policies from any OS, Windows included.</p> Licensing</h3> PolicyPress is free to run for your own organization, at any size</strong> - no subscription. It is dual-licensed under PolyForm Noncommercial 1.0.0 (nonprofits, schools, government bodies, and personal projects) and PolyForm Internal Use 1.0.0 (any company managing its own policies). In every case the source is public: read it, run it, and modify it for your permitted purpose.</p> Payment enters in exactly two places:</p> Support subscription</strong> - optional vendor support with response SLAs and indemnification, for organizations that want SC2 to stand behind their deployment. It doesn’t change the license; it’s a service.</li> Commercial license</strong> - required only to offer PolicyPress to others</em>: an MSP or consultancy running it for clients, a hosted or SaaS offering, or redistribution.</li> </ul> To discuss support or commercial licensing, contact inquiries@sc2.in</a>.</p> Getting started</h3> The fastest path is the policypress-template</a> repository: click Use this template → Create a new repository</strong>, edit config.toml</code> with your organization name and brand color, replace the logo, enable GitHub Pages, and push. Three example policies are included to adapt or replace.</p> Browse the live demo</a> to see the site, PDFs, and coverage reports</li> Read the installation guide</a></li> Install from the GitHub Marketplace</a></li> </ul> For build instructions, local preview, and configuration details, see the project on GitHub:</p> https://github.com/sc2in/policypress</a></p>



Zigmark - CommonMark Markdown Parser in Zig
Ben Craton, CISSP PMP — Mon, 23 Mar 2026 00:00:00 +0000
zigmark</h2>
A CommonMark-compliant Markdown parser and renderer, written in Zig.</strong></p>
View on GitHub →</a></p>

Why we built our own</h3>
Markdown is great, but real-world usage has grown well beyond what any single library tends to support. We wanted a stack that combined:</p>

A complete CommonMark + GFM implementation</li>
The exact extensions we care about</li>
A clean way to treat a document and its metadata as one unit, not as two loosely-related blobs.</li>
</ul>
Most existing tools either missed features we needed or treated frontmatter as something you strip off, process separately, and then glue back on. That made anything beyond “render this file” feel fragile. With zigmark, frontmatter and body stay in one coherent model, so extraction, mutation, and rendering all share the same view of the document.</p>

What it does</h3>
zigmark parses Markdown and renders it to multiple formats from a single tool:</p>

HTML</strong> for web output</li>
Typst</strong> for PDF-ready documents driven by frontmatter</li>
AST</strong> and AI-friendly representations for inspection and pipelines</li>
Normalized Markdown</strong> for clean, consistent formatting</li>
Structured frontmatter</strong> in YAML, TOML, JSON, or ZON, with first-class support for reading and editing it in place</li>
</ul>
We ship it as a CLI, as a Zig library, as a C-callable shared library, and as a WebAssembly module for browser environments.</p>

Licensing</h3>
We release zigmark free for noncommercial use</strong> under the PolyForm Noncommercial 1.0.0 license. Personal projects, research, education, nonprofits, and government institutions can use it without charge.</p>
zigmark depends on several MIT-licensed components, but the project itself is not MIT-licensed. For commercial users who want to rely on zigmark in products or paid services, we offer commercial licenses so that ongoing maintenance and support can be sustainably funded through SC2.</p>
Commercial use — products, SaaS, or client-billed consulting where zigmark is part of the value you deliver — requires a separate license from us.</p>
To discuss commercial licensing, contact inquiries@sc2.in</a>.</p>

Getting started</h3>
For usage examples, build instructions, and API details, see the project on GitHub:</p>
https://github.com/sc2in/zigmark</a></p>


Refund and Dispute Policy
Ben Craton, CISSP PMP — Thu, 05 Mar 2026 00:00:00 +0000
SC2 is committed to the security of your data and the quality of services. If you request a refund or a dispute arises, this policy applies.</p>


Indiana's Consumer Data Protection Act: What Lafayette-Area Businesses Need to Know
Ben Craton, CISSP PMP — Thu, 01 Jan 2026 00:00:00 +0000
Indiana’s Consumer Data Protection Act (ICDPA, IC 24-15</a>)
took effect on January 1, 2026</strong>. It gives Indiana residents a set of privacy rights and puts
matching obligations on the businesses that handle their data.</p>
Here is the part most coverage buries: the majority of Lafayette-area small businesses are not
covered by it.</strong> The thresholds are high. That does not mean you can ignore it — your customers,
your insurer, and your contracts increasingly will not care where the statutory line sits — but it
does mean you should know which side of the line you are on before you spend money.</p>


Ben Craton - Founder, CISSP PMP
Ben Craton, CISSP PMP — Fri, 14 Mar 2025 00:00:00 +0000